Multi Search Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent search helper, but it misleadingly says there is no external data transmission even though it sends searches to many third-party providers.

Review before installing if you may search for sensitive, private, internal, regulated, or jurisdiction-sensitive terms. The skill can send query text to Google, Baidu, Sogou, Startpage, DuckDuckGo, Brave, WolframAlpha, and other providers, despite a privacy notice claiming no external transmission. Prefer explicit provider selection and avoid secrets, personal data, account identifiers, or confidential project names in searches.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ription: "Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required."
---

# Multi Search Engine

Integration of 16 search engines for web crawling without API keys.

## Workflow

1. **Preparation**: AI Agent initializes an empty in-memory cookie store. Cookies are only acquired dynamically during search operations when access is denied

2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability.

3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting:
   - Add 1-2 second delay be

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill's security notice claims that all operations run locally with no external data transmission, but the documented behavior explicitly performs outbound requests to multiple third-party search engines. This is a material privacy and transparency issue because users may disclose queries or sensitive terms to external services under false assumptions about locality and data handling.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill automatically routes queries to domestic or international engines based on detected language without user opt-in. This can send sensitive searches to jurisdictions or providers the user did not choose, creating privacy, compliance, and trust risks, especially for Chinese-language queries routed to domestic engines.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This manifest-like JSON includes multiple CN-specific engines and explicitly marks them with region "cn", but provides no natural-language indication that the skill is region- or locale-specific or that users can choose another locale. Under the policy rule, forcing a specific locale without user opt-in is a natural-language policy concern even in config values.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly documents a parameter that disables DuckDuckGo safe search (`kp=-1`) but provides no warning that doing so can expose users to adult, graphic, or otherwise unsafe content. In a general-purpose search skill, this lowers built-in content protections and can lead to unintended unsafe browsing, especially if copied into automated or user-facing workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The Startpage parameter `nj=0` is documented as disabling the family filter without any notice about the increased risk of unsafe or adult results. Because this is operational guidance for a search integration skill, users may directly reuse the example and unintentionally bypass content-safety controls.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file presents the skill's descriptive and usage content entirely in Chinese, which can force a specific language on users without opt-in. The policy allows language constraints only when users are offered a choice or when the locale limitation is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The file presents all instructions and examples exclusively in Chinese and is framed as a domestic-search guide without indicating that language selection is optional. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The markdown provides ready-to-use `web_fetch` examples that send user-supplied search terms to third-party search engines, but it does not warn that queries may leave the local environment and be disclosed to external providers. In a search-integration skill, this is not code execution or injection risk, but it is a real privacy and data-handling concern because users may paste sensitive terms into these examples without understanding the disclosure.

Static analysis

No suspicious patterns detected.